Re: Linking Patchwork with Sashiko?

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Tue, Jul 21, 2026 at 03:25:01PM -0400, Steven Rostedt wrote:
> On Tue, 21 Jul 2026 21:25:09 +0300 Laurent Pinchart wrote:
> 
> > We've long known that we can't win if we treat security as a game of
> > whack-a-mole. Kees Cook and others have for years spent large mounts of
> > time and energy into securing the kernel by closing classes of
> > vulnerabilities. We've accepted a second programming language for kernel
> > development that should make memory-related bugs impossible in the first
> > place. In a less disruptive way, switching from C89 to C11 has enabled
> > features likes __free() that help make the code base safer.
> > 
> > Do we need to act on security issues reported by LLMs ? For the time
> > being, surely. Is that enough ? No way. It's even more important today
> > than it used to be to make whole classes of bugs impossible in the first
> > place. The good news for people interested in that development is
> > there's lots of work to be done all across the kernel :-)
> > 
> > Touting AI reviews as the solution to the security problem LLMs
> > generated in the first place without massively investing in kernel
> > hardening is in my opinion the real "putting our heads in the sand"
> > here.
> 
> Who said the two are mutually exclusive? I believe there is still a large
> effort in hardening the kernel.

I certainly hope so :-)

> AI reviews is totally agnostic to that
> effort. Roman said at LSF/MM/BPF that he's the only one working on Sashikio
> at Google. Yes, Google is investing billions (if not trillions) of dollars
> into AI, but that has nothing to do with the Linux kernel. Roman has simply
> tapped into that effort to allow the Linux kernel to take advantage of that
> investment.
> 
> It really sounds like you want companies to move effort from AI into the
> Linux kernel hardening. If Google did that, all it would do is move Roman
> from working on Sashiko to working on hardening the kernel. I think Roman
> is doing a hell of a lot more for the Linux kernel by staying with Sashiko!

As you said, it's not mutually exclusive. I'm sure Google has other
kernel developers than Roman.

-- 
Regards,

Laurent Pinchart